AWS cli medium security documentation change

Service: cli · 2026-02-28 · Security-related medium

File: cli/latest/reference/cognito-idp/update-user-pool-client.md

Summary

Increased minimum token validity duration, added CLI error format, and clarified HTTPS requirements for callback URLs

Security assessment

Changing IdTokenValidity min from 1 to 24 enforces longer-lived tokens, reducing refresh frequency exposure. Callback URL clarification strengthens HTTPS requirements (except specific localhost cases), documenting secure practices

Diff

diff --git a/cli/latest/reference/cognito-idp/update-user-pool-client.md b/cli/latest/reference/cognito-idp/update-user-pool-client.md
index 531ae66e2..13146c71a 100644
--- a//cli/latest/reference/cognito-idp/update-user-pool-client.md
+++ b//cli/latest/reference/cognito-idp/update-user-pool-client.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »
@@ -127,0 +128 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--cli-error-format <value>]
@@ -723,0 +725 @@ The formatting style for command output.
+  * off
@@ -789,0 +792,13 @@ Disable automatically prompt for CLI input parameters.
+`--cli-error-format` (string)
+
+The formatting style for error output. By default, errors are displayed in enhanced format.
+
+  * legacy
+  * json
+  * yaml
+  * text
+  * table
+  * enhanced
+
+
+
@@ -972 +987 @@ UserPoolClient -> (structure)
->>   * min: `1`
+>>   * min: `24`
@@ -1179 +1194 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -1235 +1250 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -1444 +1459 @@ UserPoolClient -> (structure)
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »